CVE-2022-3631

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	OAuth Client by DigitialPixies	>= 1.1.0, <= 1.1.0

References

https://wpscan.com/vulnerability/13966b61-7e65-4493-8bd8-828d6d4441d5Exploit, Third Party Advisory
https://wpscan.com/vulnerability/13966b61-7e65-4493-8bd8-828d6d4441d5Exploit, Third Party Advisory

Timeline

Published: Nov 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-363108.8Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker CVE-2022-363116.1Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in th CVE-2022-363128.8Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect othe CVE-2022-363135.5An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file CVE-2022-363145.5When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requ CVE-2022-363154.3When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrie CVE-2022-363166.1When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the targ CVE-2022-363176.5When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a perman CVE-2022-363185.3When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR CVE-2022-363197.5When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vu CVE-2022-36326.5The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m CVE-2022-363209.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of me